(First reported as rhbz#1944466)
Summary:
SELinux prevents tmpwatch to remove files, blocking a weird need for dac_override:
type=AVC msg=audit(1612722661.648:718821): avc: denied { dac_override } for pid=621991 comm="tmpwatch" capability=1 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tclass=capability permissive=0
This leads to the following logs:
error: failed to unlink /var/log/containers/heat: heat_api.log.2.gz
[and any other variant]
After extensive tests, it seems the way cron.daily content is launched doesn't meet all the requirement for the environment, leading to the above issue. Pushing the exact same job in root's crontab solves the issue.
This is hitting osp-16.1, so we'll need to backport it down to stable/train...
Fix for Master (and needing backports down to stable/train)
https:/